Made4Flow 2.11.1: NetFlow export for DDoS mitigation, new alerts, and much more

Check out what’s new in Made4Flow 2.11.1: export NetFlow V5, V9, and sFlow to DDoS mitigation platforms, configure alerts by router, and integrate with external systems via REST API. Anyone who operates a medium- or large-scale network knows that traffic visibility isn’t a competitive advantage—it’s a matter of survival. Identifying an ongoing DDoS attack, determining which country the anomalous traffic is coming from, or integrating the NetFlow analyzer with the carrier’s mitigation platform without having to reconfigure routers: these are real day-to-day challenges for NOC and security teams. Version 2.11.1 of Made4Flow, available starting February 27, 2026, addresses precisely these needs. In this article, we detail each new feature and what it accomplishes in practice. What is Made4Flow, and who is this update for? Made4Flow is a NetFlow and sFlow analyzer developed by Made4it for internet service providers, telecom operators, and NOC teams that need detailed visibility into network traffic. It collects flows exported by routers (NetFlow V5, V9, sFlow, IPFIX), applies intelligence to this data, and delivers real-time graphs, alerts, and analytics. This update is particularly relevant for those who: How to Export NetFlow to a DDoS Mitigation Platform — Without Configuring the Routers This is the most eagerly awaited new feature in version 2.11.1 for teams that operate DDoS mitigation platforms. The previous scenario was as follows: to send flows to a third-party mitigation solution, you had to configure the router to export simultaneously to two destinations—the Made4Flow collector and the mitigation platform’s collector. In many environments, this is not simple, is risky, or is simply unfeasible. With Made4Flow’s new flow replicator, the router continues to export flows to Made4Flow as usual. From there, the platform itself replicates and forwards the flows to any external destination in the following formats: Configuration is performed directly through the Made4Flow interface—no downtime, no maintenance window on the routers, and no operational risk. For service providers using solutions such as Wanguard, NSFOCUS, Arbor, or any other platform that uses NetFlow or sFlow, this feature eliminates a complex dependency and speeds up integration. Integrate your DDoS mitigation platform with Made4Flow and replicate NetFlow V5, V9, IPFIX, or sFlow with just one configuration. Threat Analysis: New Visualization to Identify Internal Attacks The Made4Flow Threat Analysis page has been completely redesigned in version 2.11.1. The new layout consolidates the key security metrics on a single screen: total detected threats, suspicious IP addresses, volume of malicious traffic, temporal distribution of incidents, and the main targets. The geographic view of threats has also been enhanced, making it easier to correlate the attack’s origin with its impact on the network. For security teams that need to respond quickly to incidents, this means fewer clicks and more context available at the critical moment. Find out who is launching attacks within your internal network with just ONE CLICK. Sampling Rate and Router Alerts: Stop Analyzing Distorted Data One of the most subtle issues in NetFlow monitoring is sampling rate incompatibility. When the value configured in the analysis tool differs from the one the router is actually using, all traffic graphs become distorted—and the team may make decisions based on incorrect data without realizing it. Version 2.11.1 adds two types of alerts specific to this scenario: Sampling Rate Incompatibility Alert It automatically notifies you when the sampling value configured in Made4Flow differs from what the router is reporting. This is especially useful in environments with multiple routers from different manufacturers (Cisco, Huawei, MikroTik, Juniper), where the sampling pattern may vary. Explicit alerts by router Each router registered in Made4Flow can now have its own active alerts, which are visible directly in the device list and on the edit page. This simplifies management in environments with dozens or hundreds of monitored routers. Get notified before the problem affects your data—set it up in minutes. Traffic by Country and App by Prefix: Real-Time Geographic Visibility For internet service providers and telecom operators, knowing where traffic comes from is just as important as knowing how much traffic there is. A spike originating from a particular country may indicate a volumetric attack in progress; a specific prefix consuming an unusually high amount of bandwidth may signal that a customer’s system has been compromised. Version 2.11.1 adds a new overview screen with traffic charts broken down by: This visibility was available in the raw data, but now it is presented in a native visual format, eliminating the need to export data, cross-reference spreadsheets, or use external tools. See in seconds which country or prefix is generating unusual traffic—and take action before the attack escalates. Aggregation by TCP Flags and Countries: Accurately Detect DDoS Attack Patterns Modern DDoS attacks often masquerade as seemingly normal traffic. Analyzing TCP flags—such as SYN, ACK, or RST floods—is one of the most effective ways to identify malicious traffic before it impacts services. Version 2.11.1 adds new aggregation tabs to the Made4Flow raw data: For security teams investigating incidents, the combination of analysis based on flags and geographic origin is particularly powerful for correlating attack techniques with their source. Identify attacks based on TCP flag patterns and geographic origin in seconds, without external tools. Made4Flow REST API: Integrate with Any System Version 2.11.1 marks the arrival of Made4Flow’s official REST API, opening up the platform for programmatic integrations with other systems. The API offers: In practice, this enables integrations with Zabbix, Grafana, ticketing systems, SIEM, external dashboards, and any system that retrieves data via HTTP. Connect Made4Flow to your ecosystem and automate network data using your own stack. Other improvements in version 2.11.1 Fixes in Version 2.11.1 Frequently Asked Questions About Made4Flow 2.11.1 Can Made4Flow export NetFlow data to my DDoS mitigation platform?Yes. Starting with version 2.11.1, Made4Flow includes a native exporter that replicates flows in NetFlow V5, NetFlow V9, or sFlow to any external destination, without requiring any reconfiguration of the routers. What flow formats does the exporter support?NetFlow V5, NetFlow V9, and sFlow. How does the sampling rate alert work?Made4Flow monitors the sampling rate value reported by each router

What is FlowSpec? How to use FlowSpec to mitigate DDoS attacks?

Essentially, Flowspec is an extension of the BGP protocol that allows routers to apply rules—such as dynamic ACLs or dynamic firewall rules—to specific types of traffic. These rules can be based on a variety of criteria, including source, destination, protocol, port, and so on.

The Importance of Made4Flow’s New AntiDDoS Decoders

In recent months, our technical team has seen an alarming increase in DDoS attacks of the Carpet bombing type, characterized by intense traffic spikes generally directed at all IP addresses belonging to the ASN. These attacks have negatively impacted network connectivity, presenting an additional challenge in evading detection by many conventional DDoS security systems. Unlike traditional attacks, which focus on a single IP address, these latest attacks show greater sophistication. They send smaller volumes of traffic distributed among several IP addresses, making identifying patterns and distinguishing between legitimate traffic and DDoS attacks a much more complex task. In response to these evolving cybercriminal tactics, the AntiDDoS development team at Made4Flow has taken proactive measures. We recently implemented a series of new decoders to strengthen our detection system. This improvement aims to enhance the accuracy and reliability of our anomaly detection and analysis tool, significantly improving our ability to identify and neutralize more sophisticated DDoS attacks, by taking automated actions that were previously configured in our tool—such as BGP prefix announcements for mitigation or Clean Pipe (scrubbing center) links — in addition to generating reports on the identified attack. In this article, we’ll explore the details of these new Decoders, developed on the basis of extensive Made4Flow analysis and packet captures. These implementations aim to improve the resilience of AntiDDoS, providing a more efficient defense against the complexities of contemporary DDoS attacks. New Decoders from AntiDDoS Made4Flow: • Port 0: Enables the identification of DDoS attacks that use port ZERO in the UDP protocol within an IP packet, whether as the source or destination, since this tactic is frequently used in DDoS amplification attacks.• DNS: A common feature of DDoS attacks is the receipt of packets from DNS servers or hosts responding to DNS requests. These attacks are known as DNS amplification and involve zombie machines (infected machines), servers or assets responding to DNS requests, and the target.• NTP: Another widely used tactic involves attacks using NTP servers. Like DNS-based attacks, these are known as NTP Amplification, exploiting servers or hosts that respond to NTP requests to direct the attack toward its target. Although it is common for devices connected to the network to make NTP queries to keep the date and time up to date, it is possible to improve the detection of DDoS attacks by setting a standard traffic threshold using a decoder.• SSDP: The Simple Service Discovery Protocol (SSDP) can be exploited to send large volumes of packets to the target, abusing device discovery services to amplify the attack and disrupt the target’s connectivity.• IP Fragmentation: Packet fragmentation can occur when a device is unable to send all the necessary information in a single packet. The main issue is that firewall blocks may not be as effective, and large DNS response packets may use fragmented packets. An excess of these packets can impact the network and consume excessive resources from network devices; with this decoder, we can set a threshold and make detection more accurate.• TCP SYN: This decoder plays a key role in detecting attacks known as SYN floods, which involve consuming the resources of servers or device services, rendering them unavailable for use. By setting the correct threshold, we can implement effective preventive measures, preventing this type of attack from occurring and taking actions that result in immediate mitigation.• LDAP: The LDAP decoder plays an important role in identifying DDoS attacks that exploit servers with active LDAP to perform reflections, thereby amplifying malicious traffic.• Chargen: Although it is an older protocol, it is used in some line printers and can be exploited by attackers. Setting a limit for this type of traffic is also important.• TCP and UDP High Ports: In addition to the protocols mentioned above, we have observed in several DDoS attack reports the use of high ports—above port 1024—with the TCP and UDP transport protocols. Therefore, it is important to set limits for these two protocols, making the detection of attacks that use high ports more effective. The addition of new decoders makes DDoS attack detection more efficient by supporting a variety of protocols, protecting against different types of DDoS attacks, minimizing false positives, and enabling more accurate identification of real threats. Acessar a demo do Made4FlowSuporte (WhatsApp)

Launch Made4Flow v2

We are very proud to announce the release of version 2 of Made4Flow and Anti-DDoS. Bringing several improvements, this version brings new features and optimizations. With a much more attractive look and interactive dashboard customization option, Made4Flow v2 stands out with its much more polished and refined interface, and also much faster and dynamic compared to its predecessor.

Made4Flow Updates – May 2020

Check out the latest news from Made4Flow for May—lots of new things for you 🙂

Custom Dashboard and CDN Charts by Time – Made4Flow News 02/24/2020

See what’s new in Made4Flow, our new custom dashboard and CDN charts by period.